39425 matches found
CPSD CryptoPro Secure Disk 安全漏洞
CPSD CryptoPro Secure Disk is a transparent disk encryption software developed by CPSD. There is a security vulnerability in CPSD CryptoPro Secure Disk. This vulnerability stems from the fact that configuration files in the Linux operating system’s integrity checks are not verified through the...
Astro 安全漏洞
Astro is a content-driven website framework developed by Astro OpenSource. Versions 9.0.0 to 9.5.3 of Astro have security vulnerabilities. These vulnerabilities stem from the lack of a default request body size limit on Astro servers, which can lead to memory exhaustion and denial-of-service...
Fiber 路径遍历漏洞
Fiber is an open-source web framework written in Go. Versions of Fiber v3 and earlier have a path traversal vulnerability. This vulnerability arises from the possibility of bypassing the static middleware cleaner, which may lead to the reading of arbitrary files on the Windows server file system...
Novarain/Tassos Framework, , SQL Injection
allow SQL injection and unauthenticated file reads. Attackers can chain these issues for administrator takeover and remote code execution on unpatched systems. Affected extensions include Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack, all relying on the...
PT-2026-21802
Name of the Vulnerable Software and Affected Versions Fiber versions 3.0.0 and earlier Fiber versions 3.0.0 through 3.0.0 Description A Path Traversal flaw exists in Fiber, potentially allowing a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file...
PT-2026-21803
Name of the Vulnerable Software and Affected Versions Fiber versions prior to 3.1.0 Description The use of the fiber flash cookie can lead to an unbounded allocation on any server. A specially crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory through unvalidat...
Astro 代码问题漏洞
Astro is a content-driven website framework developed by Astro OpenSource. Versions of Astro prior to 9.5.4 had code vulnerabilities. These vulnerabilities stemmed from server-side rendering of pages, where errors were handled through server-side request forgeing, potentially allowing attackers t...
GHSA-QQ67-MVV5-FW3G Astro has Full-Read SSRF in error rendering via Host: header injection
Summary Server-Side Rendered pages that return an error with a prerendered custom error page eg. 404.astro or 500.astro are vulnerable to SSRF. If the Host: header is changed to an attacker's server, it will be fetched on /500.html and they can redirect this to any internal URL to read the respon...
Astro has Full-Read SSRF in error rendering via Host: header injection
Summary Server-Side Rendered pages that return an error with a prerendered custom error page eg. 404.astro or 500.astro are vulnerable to SSRF. If the Host: header is changed to an attacker's server, it will be fetched on /500.html and they can redirect this to any internal URL to read the respon...
tempest-c2
⚡ Tempest C2 Framework Advanced Post-Exploitation & Comma...
📄 Icinga for Windows 1.13.3 Private Key Exposure
Icinga for Windows PowerShell Framework versions prior to 1.13.4, 1.12.4, and 1.11.2 install the certificate directory with insecure default permissions. The directory C:\Program Files\WindowsPowerShell\Modules\icinga-powershell-framework\certificate is created with BUILTIN\Users:RX permissions,...
PT-2026-21491
Name of the Vulnerable Software and Affected Versions datapizza-labs datapizza-ai version 0.0.2 Description A flaw exists in the Jinja2 Template Handler component of datapizza-ai. Specifically, the ChatPromptTemplate function within the datapizza-ai-core/datapizza/modules/prompt/prompt.py file is...
PT-2026-29602
Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4 Description AIOHTTP, an asynchronous HTTP client/server framework, is susceptible to excessive memory usage due to an unbounded DNS cache. This can potentially lead to a Denial of Service DoS situation if an...
CVE-2025-69303
Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ModelTheme Framework: from n/a through 2.0.0...
CVE-2026-21627
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s comajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction...
Exploit for Code Injection in Vmware Spring_Framework
ДЗ 10 — Python для аналитиков ИБ: эксплойты Описание уязви...
CVE-2026-27205
Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...
UBUNTU-CVE-2026-27205
Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...
PYSEC-2026-2151
Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...